Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 07:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mega.nz/file/Nc1FiR4Q#W4_FV_8ISnkYXGVseFFYsUbEssEP8wv2kYacNb46hog
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
https://mega.nz/file/Nc1FiR4Q#W4_FV_8ISnkYXGVseFFYsUbEssEP8wv2kYacNb46hog
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
https://mega.nz/file/Nc1FiR4Q#W4_FV_8ISnkYXGVseFFYsUbEssEP8wv2kYacNb46hog
Resource
win10v2004-20240419-en
General
-
Target
https://mega.nz/file/Nc1FiR4Q#W4_FV_8ISnkYXGVseFFYsUbEssEP8wv2kYacNb46hog
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exepid process 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe Token: SeShutdownPrivilege 2704 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe 2704 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2704 wrote to memory of 2072 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2072 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2072 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2576 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2596 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2596 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2596 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe PID 2704 wrote to memory of 2696 2704 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/Nc1FiR4Q#W4_FV_8ISnkYXGVseFFYsUbEssEP8wv2kYacNb46hog1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d79758,0x7fef6d79768,0x7fef6d797782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1088 --field-trial-handle=1284,i,6848113706714813549,3792849687577273704,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1284,i,6848113706714813549,3792849687577273704,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1284,i,6848113706714813549,3792849687577273704,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1284,i,6848113706714813549,3792849687577273704,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2300 --field-trial-handle=1284,i,6848113706714813549,3792849687577273704,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1300 --field-trial-handle=1284,i,6848113706714813549,3792849687577273704,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 --field-trial-handle=1284,i,6848113706714813549,3792849687577273704,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD5f5ee0b2cba7589d22d7d92dc7fccc75d
SHA1b40c92c993ead2855f23f009c1f33d98c7ea8ef8
SHA25624446ccc0ef5aa865753607ea325dcbe2153a5051cd095a6b094b3a363ee27e0
SHA512e18cdeeb3d690a48fa3d7c4538fbfb0002595ff9777ce4e803a0d854307bc823d80d3da06e782e4f136bcbb1b4c24f0de684a023e91b90c8c2b355fa54a886ed
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD5c77c855812e2a575c37d8d4c0b2bbf2f
SHA19623ad038c212b9d09f4ff83e4c3ba62afca585b
SHA256b8aa712c7c6021d5005e17448b15f03c5edba81d271b87b24e8a835910dee2e4
SHA5124acae2659cd430fcd8d497c78e2f66555250dbb4e7ca36d9878d232b694a92d1449fc32e458080f441eec2a6a8c85fb735fc231e29450c7ba7bab16dddc8391a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000002.dbtmpFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Temp\Tar9E0B.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
\??\pipe\crashpad_2704_QKQLIHZXNLREEADUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e